To restrict control of the Deep Security Agent service, you need to create a new group policy object (GPO). This GPO will then be applied to the workstations or servers where control of the service needs to be restricted.

The requirements needed to make a new GPO are as follows:

• Active Directory Group with Authorized Users
• Microsoft Active Directory and Users installed on the same machine as Deep Security Agent

The following steps will define a GPO for the entire domain.

1. Open the Active Directory Users and Computers.
2. Right-click the domain and then select Properties.
3. Go to the Group Policy tab and then click New.
4. Enter “Third Brigade Service Control” as the group policy name.
5. Select the group policy and then click Edit.
6. Go to Computer Configuration > Windows Settings > Security Settings > System Services.
7. From the list of services, right-click Third Brigade Deep Security Agent and then click Properties.
8. Select Define this policy settings and then choose Automatic from the service startup mode.
9. Remove Administrators from the list and then add the Active Directory group containing the authorized users. Grant this group Full Control.
10. Select the group policy object.

An update of the group policy will occur based on the settings configured within Active Directory. An update can be forced on the server or workstation by running “gpupdate /force” from the command line.